AboutFree templates
How-to · Entra ID

Set up cross-tenant access settings in Microsoft Entra ID

At the end both tenants will have each other added as organisations in cross-tenant access settings, with the inbound, outbound, trust and automatic redemption settings that cross-tenant synchronisation and tenant-to-tenant migrations rely on.

Updated 8 steps3 official sources
Start hereBack to the playbook
Before you start

What you need before step 1

Applies to: Microsoft Entra ID tenants in the same Microsoft cloud, for B2B collaboration and cross-tenant synchronisation (as documented). Cross-cloud pairs need Microsoft cloud settings as well.

Admin roles you need

  • Security Administrator in each tenant, to configure cross-tenant access settings
  • Hybrid Identity Administrator, to configure cross-tenant synchronisation afterwards
  • Cloud Application Administrator or Application Administrator, to assign users to a sync configuration

Licences

  • Microsoft Entra ID P1 or P2 on the tenant you configure, to change trust settings (including automatic redemption) or target specific users, groups or applications. B2B direct connect needs P1 in both tenants.

Web portals you will use (nothing to install)

Microsoft Entra admin centerBrowser-based, works on Windows and macOS. You need to sign in to both tenants.https://entra.microsoft.comOpen

Also have ready

  • The tenant ID or a verified domain name of the other tenant. Find your own tenant ID in the Microsoft Entra admin center on the Overview page.
  • An admin in the other tenant ready to do their half at the same time.
  • A decision on direction: the source tenant is where users live now, the target tenant is where they will be created or migrated to.
  • Microsoft warns that changing the default settings to Block access can break existing business-critical access. Change organisation settings, not defaults, unless you have checked sign-in logs.
Step by step

8 steps

  1. 1

    Open cross-tenant access settings in the target tenant

    Where: Microsoft Entra admin center (target tenant) > Entra ID > External Identities > Cross-tenant access settings

    Sign in at https://entra.microsoft.com as a Security Administrator of the target tenant. Browse to Entra ID > External Identities > Cross-tenant access settings.

    You should see: You see a Default settings tab and an Organizational settings tab.
  2. 2

    Add the source tenant as an organisation

    Where: Cross-tenant access settings > Organizational settings

    On the Organizational settings tab select Add organization. Type the source tenant's full domain name (for example fabrikam.com) or tenant ID, select it in the results, and select Add.

    You should see: The organisation appears in the list with Inherited from default under Inbound access and Outbound access.
  3. 3

    Set inbound B2B collaboration access

    Where: Organizational settings > the source organisation > Inbound access > B2B collaboration

    Select the Inherited from default link under Inbound access. On B2B collaboration choose Customize settings if you need to differ from the defaults. On External users and groups set Access status to Allow access and Applies to to All external users and groups or Select external users and groups (needs P1). Set Applications the same way. Select Save.

    You should see: The B2B collaboration tab shows your chosen access status and saves without error.
  4. 4

    Allow cross-tenant sync into the target

    Where: Inbound access settings (target tenant) > Cross-tenant sync

    Select the Cross-tenant sync tab and tick Allow user synchronization into this tenant. Optionally tick Allow group synchronization into this tenant. Select Save. If an Enable cross-tenant sync and auto-redemption dialog appears, select Yes.

    You should see: The setting saves. If you chose Yes in the dialog, automatic redemption is already ticked on Trust settings.
  5. 5

    Set inbound trust settings and automatic redemption

    Where: Inbound access settings (target tenant) > Trust settings

    Select Trust settings, choose Customize settings, and tick what your Conditional Access policies should accept from the source tenant: Trust multifactor authentication from Microsoft Entra tenants, Trust compliant devices, Trust Microsoft Entra hybrid joined devices. Tick Automatically redeem invitations with the tenant <source tenant> so users do not see a consent prompt. Select Save.

    You should see: The trust options and the automatic redemption box stay ticked after saving.
  6. 6

    Add the target tenant in the source tenant

    Where: Microsoft Entra admin center (source tenant) > Entra ID > External Identities > Cross-tenant access settings > Organizational settings

    Sign in to the source tenant as a Security Administrator. Select Add organization, type the target tenant's domain or tenant ID, select it and select Add.

    You should see: The target organisation appears in the source tenant's list.
  7. 7

    Set outbound access and automatic redemption in the source

    Where: Organizational settings (source tenant) > the target organisation > Outbound access

    Select Inherited from default under Outbound access. On B2B collaboration check that Users and groups allows the users you will sync or migrate, and that External applications allows the apps they need. Then select Trust settings, tick Automatically redeem invitations with the tenant <target tenant> and select Save. Microsoft states the consent prompt is only suppressed when inbound in one tenant and outbound in the other are both ticked.

    You should see: The outbound trust setting shows automatic redemption ticked.
  8. 8

    Test with the cross-tenant sync connection

    Where: Microsoft Entra admin center (source tenant) > your cross-tenant synchronisation configuration > Provisioning

    If you are setting this up for cross-tenant synchronisation, create the configuration in the source tenant, enter the target tenant ID in the Tenant Id box under Admin credentials and select Test connection. A policy check failure means one of the settings above is missing.

    You should see: A message says the supplied credentials are authorized to enable provisioning.
From experience

Expert tips

Change the organisation, not the defaults

Add the partner tenant under Organizational settings and customise it there. Microsoft warns that tightening default settings can break existing business-critical access with other partners. If you must change defaults, check sign-in logs for external access first.

Tick automatic redemption on both sides

Users still see a consent prompt unless inbound automatic redemption is ticked in the target and outbound automatic redemption in the source. Most AzureActiveDirectoryCrossTenantSyncPolicyCheckFailure errors come from one side missing, so agree a time with the other tenant's admin and do both halves together.

Add the partner by tenant ID

You can add an organisation by domain or tenant ID, but in a tenant-to-tenant migration the domains themselves often move between tenants. The tenant ID never changes, so record and use it in settings, scripts and documentation.

Trust MFA to avoid double prompts

Without inbound trust, synced or B2B users from the source must register and complete MFA again in the target. Ticking Trust multifactor authentication from Microsoft Entra tenants lets Conditional Access in the target accept MFA done at home, which cuts help desk calls during coexistence. Trust compliant or hybrid joined devices only if the source's device management meets your standards.

Pilot with a group before allowing everyone

With P1 or P2 you can apply inbound and outbound settings to selected users and groups. Start with a pilot group, test the cross-tenant sync Test connection, then widen the scope. Stop any sync job before removing settings it depends on.

Check it worked

How to confirm it worked

  • In both tenants, open Cross-tenant access settings > Organizational settings and check the partner is listed and that Inbound access (target) and Outbound access (source) no longer show Inherited from default where you customised them.

  • In the target tenant, open the organisation's Inbound access > Trust settings and confirm Automatically redeem invitations with the tenant is ticked; do the same on Outbound access > Trust settings in the source.

  • In the source tenant, the cross-tenant sync Test connection succeeds without an AzureActiveDirectoryCrossTenantSyncPolicyCheckFailure error.

Undo

How to reverse it

Rollback:

In either tenant go to Entra ID > External Identities > Cross-tenant access settings > Organizational settings, find the organisation and select the trash can icon on its row. The default cross-tenant access settings then apply to that organisation. Microsoft notes you cannot remove an organisation that is your cloud service provider. Stop any cross-tenant sync job before removing the settings it depends on.

Troubleshooting

Errors you might see

AzureActiveDirectoryCrossTenantSyncPolicyCheckFailure: The source tenant has not enabled automatic user consent with the target tenant.

Cause: Outbound automatic redemption is not ticked in the source tenant.

Fix: In the source tenant, tick Automatically redeem invitations on the target organisation's Outbound access > Trust settings.

AzureActiveDirectoryCrossTenantSyncPolicyCheckFailure: The target tenant has not enabled inbound synchronization with this tenant.

Cause: Inbound sync or automatic redemption is not enabled in the target tenant.

Fix: In the target tenant, tick Allow user synchronization into this tenant and inbound automatic redemption for the source organisation.

Automatic redemption checkbox is disabled

Cause: The tenant does not have a Microsoft Entra ID P1 or P2 licence.

Fix: Add Microsoft Entra ID P1 or P2 to the tenant, then configure trust settings.

ExternalTenantNotFound

Cause: For cross-cloud sync, the cross-cloud option was not selected when the configuration was created.

Fix: Delete the configuration and create it again with Setup cross-tenant synchronization across Microsoft clouds ticked.

FAQ

Questions

Do both tenants need to configure settings?

Yes for automatic redemption: inbound in the target and outbound in the source must both be ticked, or users still see the consent prompt.

Do I need Entra ID P1?

Yes to change trust settings, use automatic redemption or target specific users, groups or apps. The licence is needed on the tenant you configure.

What happens to organisations I have not added?

They use your default settings. By default B2B collaboration is allowed and B2B direct connect is blocked.

Is this the same as an Exchange organisation relationship?

No. Cross-tenant access settings live in Microsoft Entra ID. Mailbox migrations between tenants also need their own Exchange Online configuration.

Sources

Official sources

Vendors change menus and requirements. Confirm on the source before you rely on a detail. Last checked 4 Nov 2026.

Microsoft Learn: Configure cross-tenant access settings for B2B collaborationMicrosoft Docs source: Configure cross-tenant synchronizationMicrosoft Docs source: Cross-tenant access overview